[CSP] Conflict between bundles

[DavidPetrasek]

Please see: symfony/symfony#59754

[4lllex]

As far as I can tell there is an agreement to use a single value for nonce - style and script. Just browsing the code csp_nonce('script') and csp_nonce('style') return the same value, is that correct?

https://github.com/nelmio/NelmioSecurityBundle/blob/e0d39543be8813d968bd2c03766f1a5adeed7835/src/EventListener/ContentSecurityPolicyListener.php#L123-L136

    public function getNonce(string $usage): string
    {
        $nonce = $this->doGetNonce();


        if ('script' === $usage) {
            $this->scriptNonce = $nonce;
        } elseif ('style' === $usage) {
            $this->styleNonce = $nonce;
        } else {
            throw new \InvalidArgumentException('Invalid usage provided');
        }


        return $nonce;
    }

the only difference is that it sets the corresponding value in the header, something like this:

Content-Security-Policy: script-src 'self' https: 'nonce-9829e45f4e8fe2f833c4d54fba8ae9bd'; style-src 'self' https: 'nonce-9829e45f4e8fe2f833c4d54fba8ae9bd'

Since Turbo and Vite both use the same meta tag name for nonce, could you call both functions and use just one value:

{# sets script-src in CSP header #}
{% csp_nonce('script')  %}

{# sets style-src in CSP header #}
{# turbo and vite use this for script or style #}
<meta name="csp-nonce" content="{{ csp_nonce('style') }}">

[DavidPetrasek]

You're a genius!
I never realized that csp_nonce('script') and csp_nonce('style') indeed return the same value.
So I added:
{% do csp_nonce('style') %}

But... this solved the issue only partially. So I investigated further and found this was wrong:

<meta name="csp-nonce" content="{{ csp_nonce('script') }}">

because this is only satisfying Turbo. In order to also satisfy Vite:

<meta name="csp-nonce" property="csp-nonce" nonce="{{ csp_nonce('script') }}">

Since nobody noticed this in the description of my issue (symfony/symfony#59754), then maybe there should be some improvements made:
Vite's query selector should be: meta[property=csp-nonce-vite]
Turbo's query selector should be: meta[property=csp-nonce-turbo]
Usage:
<meta property="csp-nonce-turbo" property="csp-nonce-vite" nonce="{{ csp_nonce('script') }}">